WordPress Security: The 2026 Checklist to Secure Your Site (and What to Do If You're Hacked)

WordPress itself is not the weak spot. In 2025, security researchers at Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem, 42% more than the year before, and only 6 of them were in WordPress core, all low priority. The rest were in plugins (91%) and themes (9%).

That's the real picture of WordPress security in 2026: your site is as secure as the least maintained plugin you run, the weakest password on an admin account, and the backup you hope you never need. The good news is that most attacks exploit the same few gaps, and closing them doesn't take a security team.

This checklist walks through how to secure a WordPress site, in order of impact, and what to do if it's already been hacked.

Why WordPress sites get hacked#

Most WordPress compromises come from a short list of causes:

• Outdated plugins and themes with known vulnerabilities. Patchstack found that 46% of vulnerabilities in 2025 had no fix from the developer by the time they were made public, and that heavily targeted vulnerabilities were mass-exploited within a median of about 5 hours.
• Weak or reused passwords on administrator accounts, and no two-factor authentication.
• Nulled (pirated) premium plugins and themes, which often ship with backdoors.
• Too many admin users, including old accounts for freelancers and agencies who left long ago.
• Insecure hosting, shared accounts and missing backups.

Attackers don't usually pick your site by hand. Bots scan millions of sites for known weaknesses and break into whatever matches. That's why "my site is too small to be a target" doesn't hold.

The WordPress security checklist#

1. Keep everything updated#

Updates fix known vulnerabilities, and attackers move quickly once a vulnerability is public.

• WordPress core installs minor and security releases automatically by default. Keep it that way, and apply major releases promptly.
• Plugins and themes can update automatically too. Since WordPress 5.5 you can turn on auto-updates per plugin and theme from the Plugins and Themes screens.
• Delete what you don't use. A deactivated plugin is still code on your server. If you don't need it, remove it entirely, including unused themes (keep one default theme as a fallback).
• Watch for abandoned plugins. If a plugin hasn't been updated in a year or more, or was closed on WordPress.org, look for a maintained alternative.
• See what you expose publicly. The free WordPress Theme Detector shows the theme, version and plugins a page reveals to anyone who looks, which is exactly what automated scanners see.

Updates themselves can also break things, which is why many owners delay them. Our guide on how to safely update WordPress plugins shows how to update quickly without fear of breaking the site.

2. Lock down logins#

• Use strong, unique passwords for every account, stored in a password manager.
• Turn on two-factor authentication (2FA) for every administrator and editor. WordPress doesn't include 2FA by default, so add it with a reputable security plugin or your host's login protection.
• Limit login attempts. WordPress doesn't limit failed logins by itself either. A plugin, firewall or host setting stops brute-force guessing.
• Don't use "admin" as a username, and don't show login usernames as public author names.
• Use application passwords for integrations. Since WordPress 5.6, tools that connect through the REST API can use separate application passwords you can revoke individually, instead of your main password.

3. Give every user the least access they need#

• Review Users regularly and remove accounts that are no longer needed.
• Use the Editor, Author and Contributor roles for people who only manage content.
• Keep the number of Administrators as small as possible.
• An unknown administrator account is one of the clearest signs of a compromise. Check for them.

4. Only install plugins and themes from trusted sources#

Stick to WordPress.org, well-known commercial developers and vendors you can contact. Never install nulled plugins or themes, the free pirated copies of premium products. They are one of the most common ways malware gets onto WordPress sites, often with hidden admin backdoors.

Before installing anything, check when it was last updated, how many active installs it has, and whether the developer responds to support threads.

5. Back up everything, and test the restore#

A good backup turns a hack from a disaster into an inconvenience.

• Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offsite.
• Back up both the files and the database, automatically, daily for active sites.
• Store backups away from your server. A backup on the same hosting account can be deleted or infected along with the site.
• Test a restore every few months. A backup you've never restored is a hope, not a plan.

6. Choose good hosting and add a firewall#

• Pick a host that takes security seriously: isolated accounts, current PHP versions, server-level malware scanning and automatic backups.
• Use a web application firewall (WAF), at the host, through a CDN, or with a security plugin. It blocks common attacks and known exploits before they reach WordPress.
• Run malware scans regularly, and set up alerts for findings.
• Keep PHP updated to a supported version.

7. Harden WordPress#

A few settings close common doors:

• Disable the built-in file editor. Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php, so an attacker who gets into an admin account can't edit plugin and theme files from the dashboard.
• Set correct file permissions: usually 755 for folders and 644 for files, with wp-config.php stricter, such as 440 or 400 depending on your host.
• Protect wp-config.php. It holds your database credentials and security keys. Make sure it can't be read from the web, and regenerate the security keys and salts if you suspect a breach.
• Disable XML-RPC if you don't use it. It's a frequent target for brute-force attacks. Some tools, like the Jetpack plugin and certain mobile apps, still need it, so check before you turn it off.
• Turn off directory listing so visitors can't browse your folders.

8. Use HTTPS and security headers#

• Serve the whole site over HTTPS, with HTTP redirecting to it, and keep the SSL certificate valid. Check it anytime with the free SSL certificate checker.
• Add security headers at the server or CDN: Strict-Transport-Security, X-Content-Type-Options, a Content-Security-Policy, and frame-ancestors (or X-Frame-Options) to stop clickjacking.

Signs your WordPress site has been hacked#

Hacks are often designed to stay hidden from the owner. Watch for:

• Spam pages you didn't create, often in other languages, appearing in Google with site:yourdomain.com
• Redirects that send some visitors, often only mobile users or visitors coming from Google, to scam or adult sites
• New administrator accounts you don't recognise
• Unknown scripts in your pages, especially from domains you've never heard of
• A browser warning like "Deceptive site ahead" or "The site ahead contains malware", from Google Safe Browsing
• A message in Search Console under Security issues
• Sudden changes in traffic, page titles or meta descriptions, or your host suspending the account

Checking which scripts your pages load is one of the fastest checks. Our guide on how to see what scripts a website uses shows how, and the free Script Detector lists them in seconds.

What to do if your WordPress site is hacked#

1. Don't panic, and don't delete anything yet. Take a copy of the hacked site and database for investigation.
2. Change every password: WordPress admins, hosting, database, FTP or SFTP, and email. Regenerate the security keys and salts in wp-config.php, which logs everyone out.
3. Put the site in maintenance mode if visitors are being redirected or infected.
4. Restore a clean backup from before the infection, or clean the site with your host or a professional malware removal service.
5. Remove unknown admin users, and check wp-config.php, .htaccess, the mu-plugins folder and recently modified files for injected code.
6. Update everything, and remove the plugin or theme that let the attacker in.
7. Request a review in Search Console if Google flagged the site, once it's clean.
8. Find the cause, so it doesn't happen again.

How monitoring helps you spot trouble early#

A security plugin and a firewall try to stop attacks. Monitoring answers a different question: did something on my site change that I didn't expect? Many compromises show up first as a change on the page: an injected script, a new redirect, altered content, or a page that suddenly returns an error.

MyKavo isn't a security scanner or a firewall, and doesn't replace either. It compares your important pages with an approved baseline on every scan and alerts you when something changes, including:

• An unknown third-party script added to a page, flagged because unexpected scripts can indicate a compromise
• A new redirect or a changed final URL
• Page content, titles and visual changes against the baseline
• Pages going down or starting to return 404 or 500 errors, as critical alerts
• Uptime checked every five minutes, and SSL certificate expiry alerts starting 14 days before the certificate runs out

The free MyKavo WordPress plugin brings this into wp-admin. On Pro and Agency, Safe Updates checks your pages after every plugin, theme and core update and names the update behind any change, so you can keep updating quickly. Our WordPress maintenance checklist shows how to fit monitoring into a regular routine.

The bottom line#

WordPress security in 2026 is mostly about plugins, logins and preparation. Update quickly and remove what you don't use, lock down logins with strong passwords and 2FA, keep admin accounts to a minimum, take offsite backups you've tested, use a firewall and good hosting, and harden the basics. Then watch your site, because the sooner you notice an unexpected change, the smaller the damage.

Check which scripts your pages load right now with the free Script Detector, then start free with MyKavo to get alerted when an unknown script, redirect or change appears on your site.